EU AI Act

Bans a short list of uses outright, whoever builds or uses the system — among them social scoring, manipulative techniques, and inferring the emotions of people at work or in education (Article 5(1)(f)), except for medical or safety reasons. Applies since 2025-02-02.

The one part of the Act already in force that an employee can break from a prompt: asking a general-purpose chatbot how frustrated each colleague sounded in a meeting transcript is emotion inference in the workplace. The org answers for it, sanctioned tool or not.

Lists the uses that make an AI system high-risk. Point 4, employment: recruiting and selecting people (filtering applications, evaluating candidates), and decisions on promotion, termination, task allocation or monitoring and evaluating performance. Point 5(b): creditworthiness. Also education, critical infrastructure, law enforcement and more. These obligations apply from 2027-12-02.

Risk here is a property of the use, not the data: "rank these CVs" is a high-risk use whether or not the CVs hold an ID number. Only a check that reads what a prompt is for can see it.

Whoever modifies the intended purpose of an AI system — a general-purpose one included — that wasn't high-risk, so that it becomes high-risk, is considered its provider, with the provider's obligations (conformity assessment, quality management, registration).

Why shadow AI is an AI Act problem and not only a data-leak one: an employee who uses ChatGPT to screen applicants can make the org the provider of a high-risk system it never assessed. An enterprise account doesn't change that — the contract covers the data, not the use.

Deployers — the organisation using a high-risk AI system, not the vendor that built it — must use it according to its instructions, assign human oversight, monitor it, keep its logs at least six months (Article 26(6)) and inform workers before using it at work.

Narrower than it's often cited: it applies to high-risk uses only, and it doesn't require keeping data out of third-party models — that pressure comes from GDPR. What it asks for is oversight and records, which a tool the org never sanctioned can't provide.

Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and anyone else who operates or uses AI systems on their behalf — understanding what the system does, its risks, and how its outputs are produced.

The reason a tool like this simulator has an audience at all: literacy obligations reach the employees choosing what to send and what to ask for day to day, not only the policy team choosing the Protection Stack.

Providers and deployers of systems that interact with people, generate synthetic content, or perform emotion recognition/biometric categorization must disclose that fact — people need to know they're dealing with an AI system. Applies from 2026-08-02.

Adjacent to the problem this app models rather than central to it: it governs what the AI vendor and deployer must disclose outward, not what reaches the model or what it's used for.